Adversarial examples to multi-label classification:  Several recent studies [1]}, [2]}, [3]}, [4]}, [5]} showed that multi-label classification is vulnerable to adversarial examples. An attacker can manipulate the set of labels predicted by a multi-label classifier for an input via adding carefully crafted perturbation to it. For instance, Song et al. [1]} proposed white-box, targeted attacks to multi-label classification. In particular, they first formulate their attacks as optimization problems and then use gradient descent to solve them. Their experimental results indicate that they can make a multi-label classifier produce an arbitrary set of labels for an input via adding adversarial perturbation to it. Yang et al. [3]} explored the worst-case mis-classification risk of a multi-label classifier. In particular, they formulate the problem as a bi-level set function optimization problem and leverage random greedy search to find an approximate solution. Zhou et al. [2]} proposed to generate \(\ell _{\infty }\) -norm adversarial perturbations to fool a multi-label classifier. In particular, they transform the optimization problem of finding adversarial perturbations into a linear programming problem which can be solved efficiently.
